On one hand, it’s probably not that unlikely that an attacker gets 3 samples if the email or username gets reused a lot, on the other hand I wonder how well automated password crackers deal with systems like this. ‘one good pattern with a couple of extra characters per site’ seems like a pretty common password system.